Skip to content

[Linux] X509 chains with user principal name (UPN) name constraints fail to build #87413

Closed
@skeiffer

Description

@skeiffer

Description

X509Chain.Build() throws a CryptographicException when building a chain that contains a user principal name (UPN) name constraint. This prevents the caller from getting any information about the validity of the chain.

This problem is due to openSSL not supporting UPN based name constraints and MapVerifyErrorToChainStatus not mapping the status code that openSSL provides for this error (51).

This only seems affect systems that rely on OpenSSL.

  • Windows supports UPN name constraints correctly.
  • MacOS does not support UPN name constraints but skips the check.

Reproduction Steps

Add the following unit test to ./src/libraries/System.Security.Cryptography/tests/X509Certificates/DynamicChainTests.cs

[Fact]
[SkipOnPlatform(TestPlatforms.Windows, "Windows supports UPN name constraints.")]
[SkipOnPlatform(PlatformSupport.AppleCrypto, "macOS ignores UPN name constraints.")]
public static void UnknownNameConstraintViolation_UserPrincipalName()
{
    SubjectAlternativeNameBuilder builder = new SubjectAlternativeNameBuilder();
    builder.AddUserPrincipalName("johndoe@microsoft.com");

    // exlude UPN name constraint for @microsoft.com
    string nameConstraints = "3024A1223020A01E060A2B060104018237140203A0100C0E406D6963726F736F66742E636F6D";

    TestNameConstrainedChain(nameConstraints, builder, (bool result, X509Chain chain) => {
        Assert.False(result, "chain.Build");
        Assert.Equal(PlatformNameConstraints(X509ChainStatusFlags.HasNotSupportedNameConstraint), chain.AllStatusFlags());
    });
}

Expected behavior

X509Chain.Build() does not throw an exception but adds a chain status flag to the chain. (ex: X509ChainStatusFlags.HasNotSupportedNameConstraint or similar)

Actual behavior

X509Chain.Build() throws a CryptographicException

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Metadata

Metadata

Assignees

Labels

area-System.Securityin-prThere is an active PR which will close this issue when it is merged

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions